Subject: RE: REQMTS 2: Should we consider mobility?

From: [email-masked]
Date: Wed, 11 Oct 2000 13:47:54 +0300

Hi all,

> [...] A better example would be using a dhcp address which is changed at 
> renewal time. 

> > Should the ipsec sa pair and the ike sa be "handed off",  
> or dropped and
> > re-negotiated? And, should this be decided in this wg?

If the terminal sets up the IPsec tunnel from its Mobile IP 
home address to the VPN GW, and the home agent is in front of 
the VPN GW (that is, NOT inside the corporate network), then we can use 
Mobile IP to solve the mobility problem. Transparently to ipsec
and ike. We don't need to hand off or drop any ipsec/ike sa's, 
since they are between the constant home address and the gateway.
All the Mobile IP goodies are available, including for example 
intra-domain mobility. We don't need to specify anything new in any 
working group.

The drawbacks are that we need the HA, and there will be some 
overhead due to the Mobile IP tunnelling/routing headers.

Regards,
Henry

---

From: Scott Kelly <[email-masked]>
Date: Fri, 27 Oct 2000 10:04:40 -0700

Another way to interpret this requirement is in terms of single sign-on:
if a user has been authenticated while entering the corp net through one
access point, and then must change to another point of access (gateway
goes down, or some other topological change occurs which makes the
original gateway unreachable or impractical to reach), the user should
not (necessarily) have to re-authenticate.

Any comments?

Scott